summaryrefslogtreecommitdiff
path: root/drivers/scsi
diff options
context:
space:
mode:
authorVasu Dev <vasu.dev@intel.com>2011-07-27 22:10:39 (GMT)
committerJames Bottomley <JBottomley@Parallels.com>2011-07-28 08:10:35 (GMT)
commit324f667833d7ddd9501ed8c0e3ec5754ddb1b695 (patch)
tree1dbc7ce23d6c8f3c13f6c977d572be90fb95051b /drivers/scsi
parent6f06e3a7b2f2d840d42a0c2b9906f444e8f2eba6 (diff)
downloadlinux-fsl-qoriq-324f667833d7ddd9501ed8c0e3ec5754ddb1b695.tar.xz
[SCSI] libfc, fcoe: ignore rx frame with wrong xid info
Drop the rx frame having xid with wrong cpu info or received with xid not matching to our xid. Not dropping such frame is causing panic as that causes accessing data struct beyond their bounds. Signed-off-by: Vasu Dev <vasu.dev@intel.com> Tested-by: Ross Brattain <ross.b.brattain@intel.com> Signed-off-by: Robert Love <robert.w.love@intel.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi')
-rw-r--r--drivers/scsi/fcoe/fcoe.c4
-rw-r--r--drivers/scsi/libfc/fc_exch.c4
2 files changed, 5 insertions, 3 deletions
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index f7547fb..945df21 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -1373,6 +1373,10 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *netdev,
} else
cpu = smp_processor_id();
}
+
+ if (cpu >= nr_cpu_ids)
+ goto err;
+
fps = &per_cpu(fcoe_percpu, cpu);
spin_lock_bh(&fps->fcoe_rx_list.lock);
if (unlikely(!fps->thread)) {
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 7baf223..01ff082 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -802,10 +802,8 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid)
pool = per_cpu_ptr(mp->pool, xid & fc_cpu_mask);
spin_lock_bh(&pool->lock);
ep = fc_exch_ptr_get(pool, (xid - mp->min_xid) >> fc_cpu_order);
- if (ep) {
+ if (ep && ep->xid == xid)
fc_exch_hold(ep);
- WARN_ON(ep->xid != xid);
- }
spin_unlock_bh(&pool->lock);
}
return ep;